Security

Derived facts, not copies. The product keeps the structured result of analysis: component names, props, variants, token references, story references, the graph relationships between them, and the evidence behind each assertion. It does not keep a mirror of your repository, and it deliberately does not store more source than an analysis question required.

Where a snapshot or a large payload is genuinely needed during a run, it goes to object storage with a retention window rather than living in the database indefinitely.

Never your repository. Discovery is done by parsers, and models are asked narrow questions with the minimum context that question needs: a component signature and its doc comment to classify intent, two names and their variants to judge a mapping, a description to check whether it actually distinguishes anything.

The provider is abstracted rather than hardcoded, so which model answers which question is a configuration decision and not a rewrite. Every model-derived assertion records the provider, the model, the prompt version and a confidence value, which also means you can tell which findings came from a model at all.

Data is scoped to an organisation and, within it, to a workspace. Authorization is enforced on the server for every request, not in the interface, and tenant isolation has explicit tests rather than being assumed. Manipulating an identifier in a URL or an API call does not cross a boundary.

Signing in and connecting a source are separate concepts. Logging in with your GitHub account grants Onefold nothing beyond your identity. Repository access comes only from installing the GitHub App and choosing repositories, and can be revoked from GitHub without touching your Onefold account.

• Integration credentials are encrypted at rest.
• Installation tokens are short-lived, requested per run, and never written to a log.
• OAuth secrets, authorization headers and token values are excluded from logging by construction, not by redaction after the fact.
• Webhook payloads are signature-verified before anything acts on them.
• Changes to integrations are recorded as audit events: who connected what, when, and who removed it.

Disconnecting a source removes its observations and the graph nodes derived from it. Deleting a workspace removes everything inside it. Deleting an organisation removes everything, including the analysis history, and it is a real deletion rather than a flag.

Revoking the GitHub App installation cuts access immediately from GitHub's side, independently of anything Onefold does. That is deliberate: the fastest way to stop us reading your code should not depend on us.

Sub-processor lists, data residency options, retention periods in days, and incident response commitments will be published as they become real rather than as aspirations. If one of them is a blocker for you, email onefold@pitsch.me and you will get a specific answer, including “not yet” where that is the truth.

How the integrations work in practice is on the integrations pages.